General
-
Target
ttd_scam_tool_api.exe
-
Size
134.0MB
-
Sample
240125-a862xadabp
-
MD5
6ae4dad56fcd74438d8af1757d7f33eb
-
SHA1
f7ebe503c1946803f4ab1396e633bfffdce75c39
-
SHA256
7407aaf1912fe74b954790db86481e9f71b69d9ceb5da210366052c64cdf295a
-
SHA512
3a86f8f1b9e8e5629a1f6097b8ca25905676cabd6083116e5c3a545b728e37ffe53f25571c86ca97f9727cebd5bf9a33250027af703728c3b94beb5de7a508dc
-
SSDEEP
1536:nfEMGNYm3LveC4lOJqrkbH4HMAa7n6wBmMOQbY:8zGplOYrkbHj3sMOQk
Static task
static1
Behavioral task
behavioral1
Sample
ttd_scam_tool_api.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ttd_scam_tool_api.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
xworm
147.185.221.16:40164
-
install_file
tmp.exe
Targets
-
-
Target
ttd_scam_tool_api.exe
-
Size
134.0MB
-
MD5
6ae4dad56fcd74438d8af1757d7f33eb
-
SHA1
f7ebe503c1946803f4ab1396e633bfffdce75c39
-
SHA256
7407aaf1912fe74b954790db86481e9f71b69d9ceb5da210366052c64cdf295a
-
SHA512
3a86f8f1b9e8e5629a1f6097b8ca25905676cabd6083116e5c3a545b728e37ffe53f25571c86ca97f9727cebd5bf9a33250027af703728c3b94beb5de7a508dc
-
SSDEEP
1536:nfEMGNYm3LveC4lOJqrkbH4HMAa7n6wBmMOQbY:8zGplOYrkbHj3sMOQk
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detect Xworm Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-